Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
72s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 18:33
Behavioral task
behavioral1
Sample
c1537447e567c183219d9778317d2231_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
c1537447e567c183219d9778317d2231_JaffaCakes118.exe
-
Size
88KB
-
MD5
c1537447e567c183219d9778317d2231
-
SHA1
dde3b56d1e15d1885e19d74ca93bef2f3496e6a0
-
SHA256
6d1546d043b452bb171c221fc191ccef7245ad674ec0b99232cb39065f42c089
-
SHA512
21273482cb3209a5206c80c3bb83e61fc8ef53e8bbfe9274510eb33d6b25c0c7f0965cf7c9e10e0c2360fd843f258ef1c52f3b41323b46781b302cc5427a0251
-
SSDEEP
1536:vYjIyeC1eUfKjkhBYJ7mTCbqODiC1ZsyHZK0FjlqsS5eHyG9LU3YG8nh:wdEUfKj8BYbDiC1ZTK7sxtLUIGK
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemldzad.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemmiomm.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemqrauy.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemleavz.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemvztng.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemsxpjn.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemceenu.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemedxvx.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemopfzh.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemkxsja.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemartxq.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemdqtdz.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemvejkp.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemhcjdh.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemggktu.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemsqasg.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemdeegj.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemgofth.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemjxhau.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemwszlz.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemfjlpy.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemjdavz.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemmeawk.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemgbgvh.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemjtytp.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemlsafk.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemylqya.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemnkpjd.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemzhzcs.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemztmvg.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqempwjqe.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemubnmt.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemxcwsd.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemuyfwu.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemyoill.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemaobjl.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemdhjat.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemajgez.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemxnxhb.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemofnuj.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemaxcuc.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemgkyut.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemfvtgs.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemvjxyt.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemxuoks.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemxrulo.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemuuzim.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemreswi.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemdndvx.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemkfdqw.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemyupno.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemfzwek.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemhjzfu.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemblioa.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemlohob.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemgrgng.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemqcrpo.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemmmudr.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemtilnc.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemptoea.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemlboys.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemnthdg.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemultwp.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Sysqemhjyai.exe -
Executes dropped EXE 64 IoCs
pid Process 3488 Sysqemtscfl.exe 1496 Sysqemgrgng.exe 4040 Sysqemleavz.exe 4964 Sysqemvztng.exe 3212 Sysqemgyflz.exe 1060 Sysqemtilnc.exe 1216 Sysqemdeegj.exe 4644 Sysqemdwnqd.exe 1232 Sysqemolrjn.exe 4564 Sysqemvsfja.exe 3672 Sysqemgofth.exe 3956 Sysqemtxmwk.exe 3140 Sysqemdxybd.exe 4612 Sysqemopfzh.exe 552 Sysqemykgrp.exe 3424 Sysqemqcrpo.exe 4488 Sysqemwioxc.exe 5096 Sysqemnaxpw.exe 2380 Sysqemtvjkh.exe 4452 Sysqemartxq.exe 636 Sysqemfenfj.exe 2080 Sysqemqznqr.exe 1944 Sysqemylqya.exe 3892 Sysqemvjxyt.exe 5068 Sysqemxsonl.exe 4356 Sysqemdqtdz.exe 2676 Sysqemgtwtl.exe 2416 Sysqemaobjl.exe 2424 Sysqemlvhuh.exe 2020 Sysqemdgdrb.exe 1756 Sysqemlzdkj.exe 1624 Sysqemdndvx.exe 3768 Sysqemldzad.exe 1288 Sysqemldagp.exe 3544 Sysqemaajtn.exe 3124 Sysqemxxito.exe 2000 Sysqemvjege.exe 1068 Sysqemiexbv.exe 4204 Sysqemnkpjd.exe 4824 Sysqemkelet.exe 1636 Sysqemyupno.exe 3584 Sysqemdhjat.exe 4164 Sysqemvejkp.exe 4840 Sysqemqyoap.exe 2336 Sysqemfsmbk.exe 2456 Sysqemajgez.exe 3664 Sysqemabpob.exe 1068 Sysqemizcbf.exe 4504 Sysqemaynze.exe 3576 Sysqemkxsja.exe 4428 Sysqemsnppg.exe 3124 Sysqemxdvpn.exe 4380 Sysqemnthdg.exe 1120 Sysqemkfdqw.exe 2300 Sysqempwjqe.exe 3600 Sysqemvbpld.exe 1816 Sysqemhigmr.exe 4156 Sysqemptoea.exe 4836 Sysqemxuoks.exe 1004 Sysqemfjlpy.exe 4216 Sysqemxjpsj.exe 5108 Sysqemmjjtj.exe 2760 Sysqemfgjdg.exe 828 Sysqemxgmbf.exe -
resource yara_rule behavioral2/memory/2424-0-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0007000000023435-6.dat upx behavioral2/files/0x0007000000023434-41.dat upx behavioral2/files/0x0007000000023436-72.dat upx behavioral2/memory/1496-73-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0008000000023431-107.dat upx behavioral2/files/0x0007000000023437-142.dat upx behavioral2/files/0x0007000000023438-177.dat upx behavioral2/files/0x0007000000023439-212.dat upx behavioral2/files/0x000600000001e559-247.dat upx behavioral2/files/0x0002000000022ab2-282.dat upx behavioral2/memory/2424-289-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0002000000022ab4-319.dat upx behavioral2/memory/3488-326-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x000700000002343a-356.dat upx behavioral2/memory/1496-384-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x000700000002343b-393.dat upx behavioral2/memory/4040-424-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x000c00000001e561-430.dat upx behavioral2/memory/4964-436-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x000700000002343c-466.dat upx behavioral2/memory/3212-472-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x000700000001e55f-502.dat upx behavioral2/memory/1060-533-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1216-539-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x001200000001e4fb-541.dat upx behavioral2/memory/4644-572-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x000900000001e557-578.dat upx behavioral2/memory/1232-609-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x000900000002343d-616.dat upx behavioral2/memory/4564-618-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3672-649-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/files/0x0008000000023440-655.dat upx behavioral2/memory/3956-686-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3140-720-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4612-761-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/552-795-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3424-825-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4488-862-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/5096-892-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2380-921-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4452-955-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/636-962-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2676-963-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2080-992-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1944-1002-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3892-1028-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/5068-1062-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4356-1087-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2676-1127-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2416-1137-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2424-1198-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2020-1232-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1756-1274-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1624-1300-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3768-1334-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1288-1368-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3544-1402-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3124-1436-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2000-1467-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1068-1480-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4204-1538-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/4824-1572-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1636-1614-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1537447e567c183219d9778317d2231_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemopfzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemldzad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemajgez.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempkvvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwszlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemztmvg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrgpbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvbdwl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtilnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemykgrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfsmbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwplqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjtytp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembxdwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsqasg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnthdg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkfdqw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemstnxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmwsnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxdfzo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzmvta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtrcan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdqtdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzhzcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemoisal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemptoea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemofnuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgrgng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemleavz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxcwsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxrulo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcgfer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwggql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemaajtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkelet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemejhxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlsafk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemutkiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembwipm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvjxyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxxito.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemizcbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemeapdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuepyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmiomm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemambff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgkyut.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdndvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvejkp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsepmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnhgln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgtwtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemyupno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfjlpy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsuxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemuvfpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhcjdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqpgqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlboys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtscfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqyoap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmjjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfgjdg.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdqtdz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemexlyy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemggktu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwlume.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemiexbv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemizcbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemufipj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzhzcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtrcan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemajgez.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxrulo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcgfer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwggql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwszlz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwgnvb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxsonl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlvhuh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhjzfu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmmudr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsxpjn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjxhau.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlohob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxxito.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvbpld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxjpsj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxgmbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemopfzh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkxsja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembamkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwplqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgbgvh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemogrok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdxybd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemylqya.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkfdqw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemstnxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemimqhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsqasg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtilnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembaxvv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemudovx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvsfja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxdvpn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemuepyt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgkyut.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemutkiq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqembwipm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlboys.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnaxpw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvjxyt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemldagp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhjyai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlzdkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrddgx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjtytp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemofnuj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlxrum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdndvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemejhxp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemedxvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemyszpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjimyw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlsafk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdwnqd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 3488 2424 c1537447e567c183219d9778317d2231_JaffaCakes118.exe 86 PID 2424 wrote to memory of 3488 2424 c1537447e567c183219d9778317d2231_JaffaCakes118.exe 86 PID 2424 wrote to memory of 3488 2424 c1537447e567c183219d9778317d2231_JaffaCakes118.exe 86 PID 3488 wrote to memory of 1496 3488 Sysqemtscfl.exe 88 PID 3488 wrote to memory of 1496 3488 Sysqemtscfl.exe 88 PID 3488 wrote to memory of 1496 3488 Sysqemtscfl.exe 88 PID 1496 wrote to memory of 4040 1496 Sysqemgrgng.exe 89 PID 1496 wrote to memory of 4040 1496 Sysqemgrgng.exe 89 PID 1496 wrote to memory of 4040 1496 Sysqemgrgng.exe 89 PID 4040 wrote to memory of 4964 4040 Sysqemleavz.exe 90 PID 4040 wrote to memory of 4964 4040 Sysqemleavz.exe 90 PID 4040 wrote to memory of 4964 4040 Sysqemleavz.exe 90 PID 4964 wrote to memory of 3212 4964 Sysqemvztng.exe 91 PID 4964 wrote to memory of 3212 4964 Sysqemvztng.exe 91 PID 4964 wrote to memory of 3212 4964 Sysqemvztng.exe 91 PID 3212 wrote to memory of 1060 3212 Sysqemgyflz.exe 92 PID 3212 wrote to memory of 1060 3212 Sysqemgyflz.exe 92 PID 3212 wrote to memory of 1060 3212 Sysqemgyflz.exe 92 PID 1060 wrote to memory of 1216 1060 Sysqemtilnc.exe 93 PID 1060 wrote to memory of 1216 1060 Sysqemtilnc.exe 93 PID 1060 wrote to memory of 1216 1060 Sysqemtilnc.exe 93 PID 1216 wrote to memory of 4644 1216 Sysqemdeegj.exe 94 PID 1216 wrote to memory of 4644 1216 Sysqemdeegj.exe 94 PID 1216 wrote to memory of 4644 1216 Sysqemdeegj.exe 94 PID 4644 wrote to memory of 1232 4644 Sysqemdwnqd.exe 95 PID 4644 wrote to memory of 1232 4644 Sysqemdwnqd.exe 95 PID 4644 wrote to memory of 1232 4644 Sysqemdwnqd.exe 95 PID 1232 wrote to memory of 4564 1232 Sysqemolrjn.exe 96 PID 1232 wrote to memory of 4564 1232 Sysqemolrjn.exe 96 PID 1232 wrote to memory of 4564 1232 Sysqemolrjn.exe 96 PID 4564 wrote to memory of 3672 4564 Sysqemvsfja.exe 97 PID 4564 wrote to memory of 3672 4564 Sysqemvsfja.exe 97 PID 4564 wrote to memory of 3672 4564 Sysqemvsfja.exe 97 PID 3672 wrote to memory of 3956 3672 Sysqemgofth.exe 98 PID 3672 wrote to memory of 3956 3672 Sysqemgofth.exe 98 PID 3672 wrote to memory of 3956 3672 Sysqemgofth.exe 98 PID 3956 wrote to memory of 3140 3956 Sysqemtxmwk.exe 99 PID 3956 wrote to memory of 3140 3956 Sysqemtxmwk.exe 99 PID 3956 wrote to memory of 3140 3956 Sysqemtxmwk.exe 99 PID 3140 wrote to memory of 4612 3140 Sysqemdxybd.exe 100 PID 3140 wrote to memory of 4612 3140 Sysqemdxybd.exe 100 PID 3140 wrote to memory of 4612 3140 Sysqemdxybd.exe 100 PID 4612 wrote to memory of 552 4612 Sysqemopfzh.exe 101 PID 4612 wrote to memory of 552 4612 Sysqemopfzh.exe 101 PID 4612 wrote to memory of 552 4612 Sysqemopfzh.exe 101 PID 552 wrote to memory of 3424 552 Sysqemykgrp.exe 102 PID 552 wrote to memory of 3424 552 Sysqemykgrp.exe 102 PID 552 wrote to memory of 3424 552 Sysqemykgrp.exe 102 PID 3424 wrote to memory of 4488 3424 Sysqemqcrpo.exe 105 PID 3424 wrote to memory of 4488 3424 Sysqemqcrpo.exe 105 PID 3424 wrote to memory of 4488 3424 Sysqemqcrpo.exe 105 PID 4488 wrote to memory of 5096 4488 Sysqemwioxc.exe 106 PID 4488 wrote to memory of 5096 4488 Sysqemwioxc.exe 106 PID 4488 wrote to memory of 5096 4488 Sysqemwioxc.exe 106 PID 5096 wrote to memory of 2380 5096 Sysqemnaxpw.exe 107 PID 5096 wrote to memory of 2380 5096 Sysqemnaxpw.exe 107 PID 5096 wrote to memory of 2380 5096 Sysqemnaxpw.exe 107 PID 2380 wrote to memory of 4452 2380 Sysqemtvjkh.exe 108 PID 2380 wrote to memory of 4452 2380 Sysqemtvjkh.exe 108 PID 2380 wrote to memory of 4452 2380 Sysqemtvjkh.exe 108 PID 4452 wrote to memory of 636 4452 Sysqemartxq.exe 111 PID 4452 wrote to memory of 636 4452 Sysqemartxq.exe 111 PID 4452 wrote to memory of 636 4452 Sysqemartxq.exe 111 PID 636 wrote to memory of 2080 636 Sysqemfenfj.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1537447e567c183219d9778317d2231_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c1537447e567c183219d9778317d2231_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtscfl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtscfl.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgrgng.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgrgng.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\Sysqemleavz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemleavz.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvztng.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvztng.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgyflz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgyflz.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtilnc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtilnc.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdeegj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdeegj.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdwnqd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdwnqd.exe"9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\Sysqemolrjn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemolrjn.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvsfja.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvsfja.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgofth.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgofth.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtxmwk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtxmwk.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdxybd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdxybd.exe"14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\Sysqemopfzh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemopfzh.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\Sysqemykgrp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemykgrp.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqcrpo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqcrpo.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwioxc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwioxc.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnaxpw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnaxpw.exe"19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtvjkh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtvjkh.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemartxq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemartxq.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfenfj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfenfj.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqznqr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqznqr.exe"23⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemylqya.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemylqya.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvjxyt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvjxyt.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxsonl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxsonl.exe"26⤵
- Executes dropped EXE
- Modifies registry class
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdqtdz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdqtdz.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgtwtl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgtwtl.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaobjl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaobjl.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlvhuh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlvhuh.exe"30⤵
- Executes dropped EXE
- Modifies registry class
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdgdrb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdgdrb.exe"31⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlzdkj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlzdkj.exe"32⤵
- Executes dropped EXE
- Modifies registry class
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdndvx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdndvx.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemldzad.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemldzad.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\Sysqemldagp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemldagp.exe"35⤵
- Executes dropped EXE
- Modifies registry class
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaajtn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaajtn.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxxito.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxxito.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvjege.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvjege.exe"38⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiexbv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiexbv.exe"39⤵
- Executes dropped EXE
- Modifies registry class
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnkpjd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnkpjd.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkelet.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkelet.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyupno.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyupno.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdhjat.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdhjat.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvejkp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvejkp.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqyoap.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqyoap.exe"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfsmbk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfsmbk.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\Sysqemajgez.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemajgez.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\Sysqemabpob.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemabpob.exe"48⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\Sysqemizcbf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemizcbf.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaynze.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaynze.exe"50⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkxsja.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkxsja.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsnppg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsnppg.exe"52⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxdvpn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxdvpn.exe"53⤵
- Executes dropped EXE
- Modifies registry class
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnthdg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnthdg.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkfdqw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkfdqw.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\Sysqempwjqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempwjqe.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvbpld.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvbpld.exe"57⤵
- Executes dropped EXE
- Modifies registry class
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhigmr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhigmr.exe"58⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\Sysqemptoea.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemptoea.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxuoks.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxuoks.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfjlpy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfjlpy.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxjpsj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxjpsj.exe"62⤵
- Executes dropped EXE
- Modifies registry class
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmjjtj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmjjtj.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfgjdg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfgjdg.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxgmbf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxgmbf.exe"65⤵
- Executes dropped EXE
- Modifies registry class
PID:828 -
C:\Users\Admin\AppData\Local\Temp\Sysqemultwp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemultwp.exe"66⤵
- Checks computer location settings
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsxpjn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsxpjn.exe"67⤵
- Checks computer location settings
- Modifies registry class
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfzwek.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfzwek.exe"68⤵
- Checks computer location settings
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsepmk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsepmk.exe"69⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxnxhb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxnxhb.exe"70⤵
- Checks computer location settings
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhjyai.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhjyai.exe"71⤵
- Checks computer location settings
- Modifies registry class
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\Sysqemstnxv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemstnxv.exe"72⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhjzfu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhjzfu.exe"73⤵
- Checks computer location settings
- Modifies registry class
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxcwsd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxcwsd.exe"74⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmwsnn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmwsnn.exe"75⤵
- System Location Discovery: System Language Discovery
PID:912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemceenu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemceenu.exe"76⤵
- Checks computer location settings
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsuxvb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsuxvb.exe"77⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhcjdh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhcjdh.exe"78⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxrulo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxrulo.exe"79⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnhgln.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnhgln.exe"80⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Sysqempkvvi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempkvvi.exe"81⤵
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeapdp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeapdp.exe"82⤵
- System Location Discovery: System Language Discovery
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuepyt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuepyt.exe"83⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhgvge.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhgvge.exe"84⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmeawk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmeawk.exe"85⤵
- Checks computer location settings
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxdfzo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxdfzo.exe"86⤵
- System Location Discovery: System Language Discovery
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmiomm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmiomm.exe"87⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\Sysqemubnmt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemubnmt.exe"88⤵
- Checks computer location settings
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Sysqemufipj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemufipj.exe"89⤵
- Modifies registry class
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuuzim.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuuzim.exe"90⤵
- Checks computer location settings
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwplqt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwplqt.exe"91⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmmudr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmmudr.exe"92⤵
- Checks computer location settings
- Modifies registry class
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuyfwu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuyfwu.exe"93⤵
- Checks computer location settings
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\Sysqemexlyy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemexlyy.exe"94⤵
- Modifies registry class
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrddgx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrddgx.exe"95⤵
- Modifies registry class
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcgfer.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcgfer.exe"96⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuvfpn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuvfpn.exe"97⤵
- System Location Discovery: System Language Discovery
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzhzcs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzhzcs.exe"98⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjdavz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjdavz.exe"99⤵
- Checks computer location settings
PID:244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemztmvg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemztmvg.exe"100⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\Sysqemejhxp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemejhxp.exe"101⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrlnna.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrlnna.exe"102⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgbgvh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgbgvh.exe"103⤵
- Checks computer location settings
- Modifies registry class
PID:596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwggql.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwggql.exe"104⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjimyw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjimyw.exe"105⤵
- Modifies registry class
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzmvta.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzmvta.exe"106⤵
- System Location Discovery: System Language Discovery
PID:64 -
C:\Users\Admin\AppData\Local\Temp\Sysqemogrok.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemogrok.exe"107⤵
- Modifies registry class
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\Sysqembaxvv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembaxvv.exe"108⤵
- Modifies registry class
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\Sysqemudovx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemudovx.exe"109⤵
- Modifies registry class
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjxlqh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjxlqh.exe"110⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwrrys.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwrrys.exe"111⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjtytp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjtytp.exe"112⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzueul.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzueul.exe"113⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\Sysqembamkm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembamkm.exe"114⤵
- Modifies registry class
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlsafk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlsafk.exe"115⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjxhau.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjxhau.exe"116⤵
- Checks computer location settings
- Modifies registry class
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\Sysqemedxvx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemedxvx.exe"117⤵
- Checks computer location settings
- Modifies registry class
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\Sysqemutkiq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemutkiq.exe"118⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwszlz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwszlz.exe"119⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrgpbt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrgpbt.exe"120⤵
- System Location Discovery: System Language Discovery
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\Sysqemggktu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemggktu.exe"121⤵
- Checks computer location settings
- Modifies registry class
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Sysqembxdwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembxdwj.exe"122⤵
- System Location Discovery: System Language Discovery
PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-